Lenovo Thinkpad Ec Pwd Bypass

[Andreasbest]

I am killed 3 cpu
2 t14 gen 2 mec1503
1 t14 gen 3 npcx997
shorting inside cpu

Naaaah, you just don't know how to do it XD

[anhbanxoi]

I am killed 3 cpu
2 t14 gen 2 mec1503
1 t14 gen 3 npcx997
shorting inside cpu

So mean that you're doing something wrong repetitively

[Usering]

I did nothing, same method on x270, X280 , Yoga Gen (LPC Protocol) working perfect and fast
Devices (ESPI Protocol ) I tried the same way, the device stopped at the logo and the fan started spinning fasty.and stopped completely, and the power 20v disappeared on supply , checked found short 3v inside cpu , stuck on power supply 5v.

[Andreasbest]

So mean that you're doing something wrong repetitively

Nothing wrong mate, when you short eSPI and cpu gets immediately super heated means you are about to destroy it.

[ibo]

Will this method also work for HP Elitebooks Probooks G10 series?

[SMDFlea]

Will this method also work for HP Elitebooks Probooks G10 series?

No idea. The topic is for lenovo`s. Try it and let us know the results.

[szepesif]

What am I doing wrong?

E15 Gen 2, IT8227-E. I'm grounding PIN9 of the EC chip and when I'm successfull I get Fan error, KB error and it says press ESC to continue with limited performance mode. Then I press F1 to enter BIOS and I can change all settings.

BUT... If I go to supervisor password it says next to it that it's disabled and if I press a double enter with an empty password it doesn't give me back a notification that it was saved. I clear the security chip, I press ctrl+alt+del and then the laptop restarts and the password is still there. What am I missing? Why am I not getting a notification about a saved password after I double enter the empty pw fields? I even tried to enter a simple password (111) but it's not saving that either.

My timings are still wrong? Or do I have to save the settings in the BIOS after I clear or change the password?

[szepesif]

I also tried with other LPC points but have no luck, and it's really frustrating. With the other ones the BIOS is incomplete, I can only see the config and date&time options on the left menu bar but no security tab. With PIN9 I can enter the BIOS after a few tries but it's not saving the cleared BIOS.

The CMOS battery is not removed, should I remove it during tries? Or what I can do differently to make this work?

[zomi]

Yes remove battery

[szepesif]

Yes remove battery

I plugged the CMOS battery because if I remove it then it will complain about the date and time each time I start the board and I don't know if it messes up the process or not. Plus without the battery the startup is really slow each time so my tries will be much slower. But I can remove it if it's necessary, I just want to make sure I'm doing this right because I tried this almost a 100 times without any success and most likely I'm missing something.

[Andreasbest]

I plugged the CMOS battery because if I remove it then it will complain about the date and time each time I start the board and I don't know if it messes up the process or not. Plus without the battery the startup is really slow each time so my tries will be much slower. But I can remove it if it's necessary, I just want to make sure I'm doing this right because I tried this almost a 100 times without any success and most likely I'm missing something.

Disconnect speakers to force mute the beeps of reset cmos.
Connect only charger
Try closer to Lenovo post screen, also try very fast on forst moment of Lenovo logo post screen.

[Zalman]

Plus without the battery the startup is really slow each time

Do not power it down. Just Ctrl+Alt+Del for restart.
What helped me with timing on one of the devices is that I based my actions on coil whine noise as you can hear it even before the logo shows up.

[szepesif]

Do not power it down. Just Ctrl+Alt+Del for restart.
What helped me with timing on one of the devices is that I based my actions on coil whine noise as you can hear it even before the logo shows up.

Yes, that's my technique as well. I hear the coil whine and I can time it right with that help. My issue is that even if I can enter the BIOS and I can change all settings, the password is not getting removed. In the Youtube videos I saw a notification after the blank double enter showing that it has been saved. But when I double enter the password window just disappears and I didn't see any notification. After the restart, the supervisor password is still there. So I'm lost and I don't know what am I doing wrong.

The hardest part should be to enter the BIOS correctly and I think I mastered that, I can enter it but I can't save an empty pw or can't add a new one. It just simply doesn't save it. I restart the laptop and it asks for the password again.

[testinglaptops]

Hello everyone.

Here is the bypass solution for several Lenovo ECs.
This has worked on many ECs.
Only works if password is contained in EC

I succeeded on many models
https://www.badcaps.net/forum/troubl...86#post3217086
https://www.youtube.com/channel/UCeF...t_adKcguvynjeA

I shorten the LPC bus, with the LAD0:3 and Gnd.

you can use the dedicated ports where you connect directly to the track.
(Be careful, resistors may be missing on the path)
look at the diagrams

example x390 npce388


The communication being cut off, corrupted,
it cannot read information contained in EC and therefore continues.
then simply clean by rewriting after access.

Don't save with F10, just clean Pwd with enter twice.
If the serial, uuid etc. information is corrupted, you are saving the wrong information
Like the old way with sda/scl.

The method is delicate, there is always a risk of bricking or try failed.
ITE and Nuvoton is easy, Mec16 is more delicate (many try necessary).
Timing is important
watch videos to understand

works on Mec1633 / Mec1653 / Mec1663 / IT8186VG / IT5261VG / NPCE68B / NCPE288/388 and surely others

but my tests failed with the Mec1503
The LPC bus is no longer used, it has been replaced by eSPI

Attached some connection diagrams for tested models

Edit
-----------------------
EC PWD eeprom location

NCPE68B
Dmi start from 0x5C120 and 0x5D120
Pwd 0x5C420 - 0x5C56F and 0x5D420 - 0x5D56F replace with 00

NCPE288/388
Dmi start from 0x30000
Pwd
0x36000 - 0x3604F
0x36080 - 0x360CF
0x36100 - 0x3614F
0x36180 - 0x361CF
0x36200 - 0x3624F
0x36280 - 0x362CF
0x36300 - 0x3634F
0x36380 - 0x363CF
0x36400 - 0x3644F
0x36480 - 0x364CF
0x36500 - 0x3654F
0x36580 - 0x365CF
0x36600 - 0x3664F
0x36680 - 0x366CF
replace with 00

Mec1663 Dmi start from 0x00
Pwd 0x300 - 0x34F replace with FF

search for this shape

Thank you. worked for me. I have vertyanov successor but i want to try your method, i tried on Lenovo x1 Yoga Gen 3. i tried 20 time or more. after i got the exact time to short. thank you again

[zDarkStarz]

Hi,

Does this method work on the Thinkpad P50? It seems to have the same LPC but I tried with no success so far. Thanks!

[szepesif]

After a few hundred tries I can confirm that this method is not working for Lenovo Thinkpad E15 Gen 2 with ITE8227E EC chip. I tried it with all points, at least a few hundred times. I can log in to the bios with this method easily now, but when I double enter the empty password it never saves it, no notification, nothing. Then the ctrl + alt + del is not restarting the machine either, it just hangs with a black picture. So I have to order a programmed EC chip, unfortunately. I leave this for other users who have the same laptop. It won't work with this method, you will need a programmer or a programmed password-free EC chip.

[zDarkStarz]

Update:

This method works with Thinkpad P50 - MEC 1653L. The issue I had before is caused by the resistors (R488, R489, R490, R491) did not populate, so I have been shorting the wrong side.
Do it on the other side works.

[Maxpower3]

[QUOTE=zDarkStarz;n3518890]
Update:

This method works with Thinkpad P50 - MEC 1653L. The issue I had before is caused by the resistors (R488, R489, R490, R491) did not populate, so I have been shorting the wrong side.
Do it on the other side works.
[QUOTE]

thanks for feedback

[santoslao]

Pwd Bypass T14 GEN1 method SVP in 10 seconds done!!

by Maxpower3

[Armandio92]

any luck with aN lL15 GEN2 with npce68bpa0dx? tried the short circuit video dozens of time and no luck...